Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-35503

LDAP Group query always uses scope=one

    XMLWordPrintable

Details

    • Untriaged
    • Unknown

    Description

      I'm testing out Group Auth with user attribute `memberOf`.  The entry is as follows.

      ldapsearch -x -LLL -H ldap:/// -b "uid=cbman,ou=People,dc=example,dc=com" +
      dn: uid=cbman,ou=People,dc=example,dc=com
      memberOf: cn=mygroup,ou=Groups,dc=example,dc=com
      entryDN: uid=cbman,ou=People,dc=example,dc=com
      subschemaSubentry: cn=Subschema
      ...

       

      Problem is  the LDAP url used to fetch the memberOf attribute doesn't return the group when scope is set to one.

       

       ~$ curl -user $CREDS "ldap://<host:port>/uid=cbman,ou=People,dc=example,dc=com?memberOf?one"
      ~$ 

       

      But If I use base or sub, then it works:

       

       ~$ curl --user $CREDS "ldap://<host:port>/uid=cbman,ou=People,dc=example,dc=com?memberOf?base"
      DN: uid=cbman,ou=People,dc=example,dc=com
      memberOf: cn=mygroup,ou=Groups,dc=example,dc=com
      ~${code}

       

      Is there any reason why scope can't be changed for the userAttribute group matching?  I noticed it can be set for 'LDAP Query' option for groups.

       

       

       

      Attachments

        For Gerrit Dashboard: MB-35503
        # Subject Branch Project Status CR V

        Activity

          People

            ritam.sharma Ritam Sharma
            tommie Tommie McAfee (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty